The Investigative Questions Come First
Before describing the devices or data you want examined, identify the specific questions the examination is meant to answer. What are you trying to establish — or refute? Was a file accessed on a particular date? Were communications authentic? Did an employee copy data before departing? Was an image manipulated?
A well-scoped examination is organized around specific evidentiary questions, not a general instruction to "examine everything." Examiners who examine everything produce reports that say very little about anything in particular — and cost significantly more.
What to Provide
When initiating contact, include the following:
- The devices or data sources at issue. Computers, phones, tablets, external drives, cloud accounts, email systems, or specific platforms. Identify what you have, what you need, and whether original devices are available or whether you will need to work from preservation orders or prior forensic copies.
- Relevant time periods. The dates or date ranges that matter to your questions. This limits the scope of analysis and directly affects cost.
- The specific questions you need answered. Write them out as questions, not conclusions. "Did the defendant access the folder containing the customer list?" is a question. "Prove the defendant stole data" is not.
- Any prior forensic work. If another examiner has already imaged or examined the devices, say so. Provide any reports or findings if available. This avoids duplication and may affect what additional work is needed.
- Deadlines. Expert disclosure deadlines, trial dates, or any court-imposed timelines that affect when the report must be completed.
What Not to Include in Initial Contact
Do not include privileged case details in initial contact before a conflict check has been completed and an engagement letter executed. The matter type, a general description of the devices or data, and your questions are sufficient to assess whether the engagement is appropriate and to begin scoping.
What Happens Next
With this information, a written scope of work and budget estimate can be prepared for your review. No billable work begins until you have approved the scope and budget in writing. The engagement letter is executed after that approval — not before.